Health Management: Violation of HIPAA – Confidentiality

Health Management: Violation of HIPAA – Confidentiality

The Health Insurance Portability and Accountability Act is a federal policy, which was introduced in 1996. It is a significant piece of legislation, which was introduced to make it easier for the organization to manage healthcare, eliminate any sort of fraud that may emerge in the healthcare system, promote universal health coverage, and eliminate or minimize wastages.

Various updates have been made to the HIPAA law with an attempt to foster the privacy and protection of patients. Also, it is aimed at improving the protection of the members of the health care plan over the years. The updates have made it easier for the healthcare data to be safeguarded and foster the protection of the patients.  The updates encompass the HIPAA Omnibus Rule, the HIPAA Breach Notification Rule, the HIPAA Privacy Rule and the HIPAA security rule (Davidoff, 2019).

The violation of HIPAA is the inability to comply with the various provisions and standards that have been detailed in multiple parts of the 45 CFR; including 164, 162 and 160 (Hubbartt, 2018). The HIPAA regulations were published by the office of human services for Civil Rights and the Department of Health. It has a total of 115 pages and has many provisions (Hubbartt, 2018). There are various ways through which the HIPAA laws can be violated, but the most common include the following. One violation is the illegal disclosure of any health data, which has been protected.

The other violation is to access the PHI illegally. Another violation is unlawful dumping of the PHI. The other violation is the failure to document the efforts that have been made to comply. The other violation is to email and mishandles PHI wrongly. Another common violation is to share any information regarding the PHI on social media or any online media site illegally.

Another common violation is the failure to notify authorities on any breach within 60 days after the discovery of the breach. Stealing the information of patients is also regarded as a high violation (Davidoff, 2019). Releasing health information such as PHI to unauthorized individuals is another common violation. The inability to monitor the login systems of the PHI is also a violation of HIPAA.

Additionally, health institutions also violate the HIPAA rules when they fail to provide the necessary awareness of security and training. Health institutions further violate HIPAA rules when they fail to close or log off the access rights to a particular PHI. The failure to put in place effective measures, which detail those persons who are authorized to access a specific PHI system, is another critical violation (Supremus Group, 2014).

Health institutions also violate the HIPAA rules, if they fail to enter the correct business associate for complying with HIPAA in the agreement before there is a PHI access. Health institutions also violate the HIPAA rules when they have not conducted a proper risk assessment. Furthermore, they can also violate the HIPAA rules when risks affecting the integrity and confidentiality of the PHI are not adequately managed (Hubbartt, 2018).

Obligations of a health care organization to Meet Patients’ Legal Rights

One legal obligation is that health care organizations must safeguard the information and data of patients. Every healthcare organization should ensure that every information given by the patients remain private and confidential and is only accessible to authorized persons. The other legal obligation is that the integrity of the patient should be protected at all times and therefore the medical practitioners should only discuss and involve themselves in activities that are geared towards fostering the recovery of the patients and should not in any way jeopardize or interfere with the privacy of the patients (Supremus Group, 2014).

Consequences for non-compliance

The consequences of violating HIPAA rules can be severe. State judges can authorize fines of up to $25,000 for every violation, every year. OCR, on the other hand, can issue fines of up to $15 million per violation every year (Davidoff, 2019). There have also been examples of cases where multi-million dollar fines have been issued.

While the most significant number of fines usually falls on the healthcare providers and business associates who have been covered by various entities, individuals who have violated HIPAA rules have also been charged and penalized for the same. The HIPAA rules also suggest jail term for those who violate these rules, which include a maximum of ten years (Supremus Group, 2014).

There are four main tiers, which detail the consequences of HIPAA violations.  The first tier is where the health institution was not aware that there was a violation and even through proper due diligence, would still have found it difficult to unravel a breach. The fines for the first tier range from $ 100 to $50,000 every violation depending on the level of negligence or a maximum of $25,000 every year (Hubbartt, 2018). The second tier is where there are sufficient reasons that a violation would have been unravelled through proper due diligence. The fine in this tier ranges from $1000 to $50,000 every violation or a maximum of $100,000 every year (Hubbartt, 2018). The third tier is where there is evident neglect of the HIPAA regulations, but with a correction within the first thirty days. The fines in this tier range from $10,000 to $50,000 for every violation or a maximum of $250,000 every year (Hubbartt, 2018).

A good real-life example, which explains the above, is a 2019 HIPAA violation case involving the West Georgia Ambulance. There was an investigation by OCR on the ambulance company in Carroll County. The company had been notified about the loss of a laptop, which had not been encrypted. The laptop had PHI of close to 500 patients.  The primary violations, in this case, were the failure to conduct a risk analysis on the PHI, the failure to abide by the HIPAA security procedures and policies and the apparent lack of a security awareness and training program (HIPAA Journal, 2020).

Some specific actions, which I could institute as a health care manager to ensure that the health care organization does not violate the mandate to protect the rights of the patients include the following.  The first action would be to formulate a risk management plan, which we are aimed at analyzing all the possible risks facing the organization. I would incorporate computer risk management software to evaluate all the potential risks. The second action would be to write a memo, emails and make phone calls to all employees to create awareness about the risks and encourage them to report any threats or risks as and when they find them. Finally, I would ensure that all computers and laptops in the organization are encrypted and are only available to a few authorized persons (Hubbartt, 2018).

In conclusion, the study captures the most important aspects of HIPAA violation, including the caps and all legal anecdotes of the laws. The study mainly assesses various forms of violations and the different consequences of these violations. HIPAA is a federal policy, and therefore the mandate of making fines or penalties rests solely on the federal attorneys. Various steps should be taken to avert HIPAA violations as stipulated in the study through the real-life case study detailed in the study. It is, therefore, an indispensable responsibility for every health institution to ensure that they comply with all the stipulated HIPAA laws.

References

Davidoff, S. (2019). Data breaches: Crisis and opportunity. New York, NY: Addison-Wesley Professional.

HIPAA Journal. (2020). Ambulance Company Settles HIPAA Violation Case with OCR for $65,000. Retrieved from https://www.hipaajournal.com/ambulance-company-settles-hipaa-violation-case-with-ocr-for-65000/

Hubbartt, W. S. (2018). HIPAA privacy sourcebook: A collection of practical samples. New York, NY: Society for Human Resource.

Supremus Group. (2014). The complete, concise HIPAA reference 2014 edition. Waukee, IA: Supremus Group LLC.